I am trying to setup a Syslog Universal Forwarder on a client site which in turns forwards all syslog to my main Splunk Server.
I have the forwarder setup correctly as it can collect all local windows data on the server itself and forward that to my server. What do i need to do to setup syslog listening and then forwarding on the Splunk UF ?
i figured it out
put this in the inputs.conf
[udp://:514]
sourcetype = syslog
connection_host = dns
[tcp://:514]
sourcetype = syslog
connection_host = dns